scripts: apply hardening for systemd service (#5332)

6 years ago · 66016b8499
1 changed files with 4 additions and 0 deletions
--- a/scripts/systemd/gogs.service
+++ b/scripts/systemd/gogs.service
@ -18,6 +18,10 @@ WorkingDirectory=/home/git/gogs
 ExecStart=/home/git/gogs/gogs web
 Restart=always
 Environment=USER=git HOME=/home/git
+# Hardening
+ProtectSystem=full
+PrivateDevices=yes
+PrivateTmp=yes

 [Install]
 WantedBy=multi-user.target